[fix][broker] Let TokenAuthState update authenticationDataSource #19282
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
michaeljmarshall
added
type/bug
4 tasks
2 tasks
lhotari
reviewed
Jan 19, 2023
| @@ -375,6 +383,7 @@ public String getAuthRole() throws AuthenticationException { | |||
| public AuthData authenticate(AuthData authData) throws AuthenticationException { | |||
| String token = new String(authData.getBytes(), UTF_8); | |||
| checkExpiration(token); | |||
| this.authenticationDataSource = new AuthenticationDataCommand(token, remoteAddress, sslSession); | |||
There was a problem hiding this comment.
Are there any thread safety concerns here? would it make sense to make authenticationDataSource field volatile?
There was a problem hiding this comment.
Good question. The current usage of this field in the pulsar code base is all from netty event loops, so I don't think that is needed. Similarly, the jwt and the expiration are not volatile. I see that expiration is called from another thread, so that one might be an issue.
nodece
approved these changes
Jan 20, 2023
Codecov Report
@@ Coverage Diff @@
## master #19282 +/- ##
============================================
+ Coverage 47.04% 52.62% +5.58%
- Complexity 9190 22238 +13048
============================================
Files 607 1824 +1217
Lines 57677 136692 +79015
Branches 6007 15044 +9037
============================================
+ Hits 27132 71939 +44807
- Misses 27598 57271 +29673
- Partials 2947 7482 +4535
Flags with carried forward coverage won't be shown. Click here to find out more.
|
1 task
michaeljmarshall
added a commit
to michaeljmarshall/pulsar
that referenced
this pull request
Apr 19, 2023
…che#19282) (cherry picked from commit c875365)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation
We use the result of
TokenAuthenticationState#getAuthDataSourceto pass to theAuthorizationProvider. For custom implementations, it is important that this information is up to date.The
TokenAuthenticationStatefieldAuthenticationDataSourceis set on initialization and never again. Given that tokens can be refreshed, we should update the fieldTokenAuthenticationState#authenticationDataSourcewhen theauthenticatemethod is called.Modifications
authenticationDataSourcewhenauthenticateis called.Verifying this change
A new test is added to cover this change.
Does this pull request potentially affect one of the following parts:
This change will only affect third party
AuthorizationProviderimplementations. It's possible that it could break their integration, though unlikely. Note that we update theauthRolewhenauthenticateis called.Documentation
doc-not-neededWe do not document this kind of internal behavior anywhere.
Matching PR in forked repository
PR in forked repository: michaeljmarshall#15